What CMMC Level 2 costs, by DoD's own estimate.

What is suspended, and what still applies

The press release states: "Effective immediately, the Department will suspend the transition to Phase II requirements of CMMC, as well as pending and future CMMC implementation milestones across the Department of War solicitations and contracts." It also states: "All defense contractors and subcontractors remain contractually obligated to safeguard covered defense information in accordance with DFARS clause 252.204-7012." ¹

The implementing memorandum states: "Program Managers and requiring activities may not designate CMMC Level 2 (C3PAO) or Level 3 (DIBCAC) assessments during this period. The allowed designations are CMMC Level 1 (Self) or CMMC Level 2 (Self)." ²

The DoD CIO About CMMC page states: "On July 13, 2026 the DoW suspended the implementation of Phase II of the CMMC and established a CMMC reform task force." It also states: "The CMMC Program is paused in Phase 1 and may only require self-assessments at two levels." For Level 2 it describes "A self-assessment every three years, with annual affirmation of compliance with the 110 security requirements in NIST SP 800-171 Revision 2." ³

No Federal Register notice in these sources amends 32 CFR part 170. The suspension is the press release and the memorandum. The rule text remains the October 15, 2024 final rule, 89 FR 83092. ^{4, 1, 2}

DFARS 252.204-7019 still tells an offeror that must implement NIST SP 800-171 to verify that summary level scores of a current assessment "are posted in the Supplier Performance Risk System (SPRS)" for covered contractor information systems relevant to the offer. ⁵

DoD's small-entity estimates

The figures below are DoD's small-entity estimates from the rule's public cost analysis. Page numbers are the Federal Register pages in 89 FR 83092. The rule prints an asterisk before some of the headline dollars. The amounts below are the dollars in that text. ⁴

• Level 1 self-assessment and affirmation, page 83181. The rule states: "It is estimated that the cost to support a CMMC Level 1 self-assessment and affirmation is $5,977 (as summarized in 4.1.2, table 10)." It also states: "It is estimated that the costs to reaffirm a CMMC Level 1 annually for a small entity is $560." A Level 1 self-assessment is conducted annually.
• Level 2 self-assessment and affirmation, page 83183. The rule states: "It is estimated that the cost to support a Level 2 self-assessment and affirmation for a small entity is $34,277. The three-year cost is $37,196 (as summarized in 4.1.2, table 10), which includes the triennial assessment + affirmation, plus two additional annual affirmations ($34,277 + $1,459 + $1,459)." The annual reaffirmation in that build-up is $1,459.
• Level 2 certification assessment by a C3PAO, pages 83185 and 83186. The rule states: "It is estimated that the cost to support a Level 2 certification assessment and affirmation for a small entity is $101,752. The three-year cost is $104,670 (as summarized in 4.1.2, table 10), and includes the triennial assessment + affirmation plus two additional annual affirmations ($101,752 + $1,459 + $1,459)." The C3PAO fee in that section is stated as: "C3PAO engagement inclusive of Phases 1, 2, and 3 (3-person team) for 120 hours ($260.28/hr x 120hrs = $31,234)."
• Level 3, pages 83187 and 83188. The assessment and initial affirmation figure for a small entity is $9,050, and the three-year figure is $12,802. That is not the full Level 3 cost. The same section states: "Small Entities Nonrecurring Engineering Costs: $2,700,000. Recurring Engineering Costs: $490,000." The rule also states: "The OSC should keep in mind that the total cost of a Level 3 certification assessment includes the cost of a Level 2 certification assessment as well as the costs to implement and assess the security requirements specific to Level 3."

What these figures leave out

DoD's figures exclude the cost of implementing NIST SP 800-171 itself. On page 83179 the rule states: "DoD did not consider the cost of implementing the security requirements themselves because implementation is already required by FAR clause 52.204-21, effective June 15, 2016, and by DFARS clause 252.204-7012, requiring implementation by Dec. 31, 2017, respectively; therefore, the costs of implementing the security requirements for CMMC Levels 1 and 2 should already have been incurred and are not attributed to this rule." ⁴

The $5,977, $34,277, and $101,752 figures are assessment and affirmation estimates. They are not a price for closing security gaps, buying tools, or hiring someone to implement the 110 requirements.

CMMC tool prices in this directory

The table lists CMMC tools in this directory, in name order. Each dollar is the figure stored for that plan. A row marked By quote has no published dollar in the record. This list is not a ranking.

Where to go next

• The SPRS score calculator walks the 110 requirements and shows an estimated score. The estimate is not an SPRS entry.
• CMMC firms lists assessors and consultants from what each firm publishes about itself.
• CMMC Level 2 tools summarizes where Level 2 stands, with the memos and the rule sections this directory cites.